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In the claims; 

J. (Currently Amended) Computer d evice configured as a fettegfl-pattem 
recognition npparatti s tor automatically discoverin g groups of resources that are assigned 
in common to groups of users, the users, resou rces^ and current assignments beiriR input 
as nodes in respective pattitions ^fe r grouping nodes acoording to relationshipo with oth e r 
nedesrthc apparatus comprising: 

an input for receiving an arrangement of nodes, said arrangement comprising at 
least two partitions of said nodes and with predetermined relationships between nodes 
across ssud partitions, and 

a pattern recognition unit associated with said input, tor automatically finding 
relationship patterns amongst said r^cA^^, said finding comprising using pattern 
recognition on said nodes and said relationships, th e rah y -and bv said pattern recognition 
to form at least one group from nodes of a first of said partitions, wherein said nodes 
being formed into said group share relationships with somo onoo of a predetermined 
number of nodes in a second pBititton^said relationships comprising common w;ce$s 
permissions! and 

an output unit for outputring said nodes as said at least one formed group. 

2. (Original) The apparatus of clahn 1, wherein said nodes in said first 
partition are users of a network, said nodes in said second partition are resources of said 
network and said relationships are access permissions. 

3. (Original) The apparatus of claim 1, wherein said nodes in said first 
partition are users of a network, said nodes in said second partition are resources of said 
network and said ielationships are usage levels of respective resources by respective 
users. 

4. (Original) The apparatus of claim 2, wherein said relationships further 
comprise user access permission levels for respective resources. 
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5. (Original) The apparatus of claim 2, wherein said at least one group is 
definitive of a user role on said network. 

6. (Original) The apparatus of claim 1, wherein said nodes in said first 
partition are entitles having attributes and said nodes in said second partition represent 
said attributes, and said relationships represent a respective user possessing a respective 
attribute 

7. (Original) The apparatus of claim 2, wherein said panem recognition unit 
is associated with a search engine operable to use a search tree to begin with a single 
resource and its associated users, and iteratively to add resources and remove users not 
having a predefined relationship with said iteratively added resources, to meet a resource 
number, or a user number constraint 

8. (Original) The apparatus of claim 7, wherein said search engine is 
operable to use a homogeneity measure to determine whether to consider a candidate 
grouping in said search. 

9. (Original) The apparatus of claun 7, wherein said search engine is 
operable to use a homogeneity measure to determine in which order to consider a 
candidate grouping in said search. 

10. (Original) The apparatus of claim 7, wherein said search engine is 
operable within said iterative stages to. add further resources common to a current set of 
users. 

11. (Original) The apparatus of claim 10, wherein said search engme is 
operable to compute a set of all users related to a current set of resources. 
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12. (Original) The apparatus of claim 11, wherein said search engine is 
operable to consider for expansion all resources outside said current set of resources that 
have at least one relationship connection with a current set of users. 

13. (Original) The apparatus of claim 8, wherein the set of users associated 
with each of said nodes is associated with attributes, and wherein said homogeneity 
measure is the percentage of occurrence of a given attribute, multiplied by the log value 
thereof, summed over all such users in said result. 

14. (Original) the apparatus of claim 8, wherein the set of resources 
associated with each of said nodes is associated with attributes, and wherein said 
homogeneity measure is the percentage of occurrence of a given attribute, multiplied by 
the log value thereof, summed over all such resources in said result. 

15. (Original) The apparatus of claim 8, wherein said homogeneity measure is 
the percentage of occurrence of a given resource relationship for any of the users 
associated with at least one of the resources of said node, multiplied by the log value 
thereof, summed over all users of said node in said resuh. 

16. (Original) The apparatus of claim 8, wherein said homogeneity measure is 
the percentage of occurrence of a given user relationship for any of the resources 
associated with at least one of the users of said node, multiplied by the log value thereof, 
sunmied over all resources of said node in said result. 

17. (Original) The apparatus of claim 1, wherein said pattern recognition unit 
is operable to use said pattern recognition within an iterative tree searching process. 

18. (Original) The apparatus of claim 1, wherein said pattern recognition unit 
is opemble to insert said groupings as an intermediate partition amongst said nodes, 
thereby to redefine said relationships' through said groupings. 
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19. (Original) The apparatus of claim 1, wherein said nodes are arranged into 
three partitions, an intermediate one of said partitions comprising predetermined 
relationship dependent groupings of at least some of the nodes in a first of said partitions, 
said pattern recognition unit being operable to use said pattern recognition to add new 
groups to said intermediate partition. 

20. (Previously Presented) The apparatus of claim 1, wherein said input is 
associated with a graphical expositor, which presents said input in a graph, said graphical 
expositor being operable to form said nodes into said partitions. 

2h (Original) The appar^s of claim 20, wherein the graphical expositor is 
user interactive to manually modify the groupings discovered by the pattern recognition 
engine. 

22. (Original) The apparatus of claim 20, wherein said graphical expositor is 
further operable to partition the graph into sub-graphs, each of the sub-graphs itself being 
a partitioned graph having at least two partitions, the sub-graphs being limited to a subset 
of the nodes in one of the partitions, and further comprising all the nodes in the other 
partition that are linked thereto, and wherein said pattern recognition unit is further 
operable to perform groupings on each of the subgraphs, and then to merge the results 
into a full graph. 

23. (Original) The apparatus of claim 20, wherein said graphical expositor is 
further operable to partition the graph into sub-graphs, each of the sub-graphs itself being 
a bi -partite graph limited to a subset of the nodes in the second partition, and fiirther 
comprising all the nodes in the first partition that are linked thereto, and wherein said 
pattern recognition unit is fiirther Operable to perform groupings on each of the 
subgraphs, and then to merge tlie results into a full graph. 
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24. (Original) The apparatus of claim 20, wherein said graphical expositor, i$ 
user interactive to allow an operator to review user group associations and user resource 
relations, and to allow said operator to manipulate user access rights. 

25. (Currently Amended) Pattern recognition method for electronically 
grouping nodes according to relationships with other nodes, the method comprising: 

receiving an arrangement of nodes, said arrangement comprising at least uwo 
partitions of said nodes and with predetermined relationships between nodes across said 
partitions, and 

automatically finding reliationship patterns amongst said nodes using pattem 
recognition on said nodes and said relationships, thereby to form at least one grouping of 
nodes of a first of said partitions, wherein said nodes being formed into said grouping 
share relationships with same ones of a predetermined number of nodes in a second 
partition , and 

outputting said nodes as said at least one formed ^roup. 

26. (Currently Amended) A reverse engineering device tool for discovering 
structure in a partitioned nodal arrangement, the device teel comprising: 

an input for receiving an arrangement of nodes, said arrangement comprising at 
least two partitions of said nodes and with predetermined relationships between nodes 
across said partitions, and 

a pattern recognition unit for automatically finding relationship patterns amongst 
said nodes using pattern recognition on said nodes and said relationships, thereby to form 
at least one group from nodes of a first of said partitions, wherein said nodes being 
formed into said group share relationships with same ones of a predetermined number of 
nodes in a second partition, and 

an output configured to output said nodes as said at least one formed group,. 



